A global Russian disinformation operation faked the websites of a number of prominent and even internationally renowned news outlets, among them Israeli websites in Hebrew and even a Jewish American newspaper, as part of the Kremlin’s attempt to advance its war efforts against Ukraine.
The operation was revealed Tuesday by France and was attributed by French authorities directly to “Russian actors” and “state entities (or entities) affiliated with Russia that participated by amplifying false information.” The statement by the French Foreign Ministry is an escalation of Western efforts against Russia’s information war.
The operation began two years ago and, though partially revealed last year, was still up and running this month. Among the outlets whose websites were forged and presented as real: The French newspapers Le Monde, Le Figaro and La Parisian; Der Spiegel, Süddeutsche Zeitung, Die Welt and Bild in German; the Israeli sites Mako and Liberal in Hebrew; and even the Jewish Journal, a prominent Jewish American outlet published in English.
The forged websites all published reports supposedly penned by real journalists employed by the actual outlets. All of the reports echoed the same narrative: the country’s support of Ukraine was harming its economy, if not fueling an actual economic crisis. Their goal was to undermine popular and political support in France, Germany and Israel for aiding Ukraine against Russian aggression.
French authorities began investigating the operation about a year ago and discovered the faked sites all share the same infrastructure. In a press release, France attributed the operation to Russia and blasted Russian disinformation efforts. German authorities were also updated. Israel’s Shin Bet, which is charged with defending against foreign intervention attempts, is aware of the operation.
Israel has frequently been targeted alongside other states by Russian disinformation efforts. However, this seems to be the first time that content aimed at Israel was also aimed at American Jewry. There were at least three forged Jewish Journal reports, including one about Ukrainian President Volodymyr Zelenskyy’s attack on Iran “harming Israel” and possibly another about Florida Governor Ron DeSantis.
The operation is among the most intricate revealed in recent years: running in multiple languages across multiple platforms with a complex array of technological defense mechanisms aimed at both expanding its reach and evading detection. Key parts of the campaign were revealed last year by Meta, which blocked some of its domains, but the operation began anew this year after a short hiatus.
Dubbed operation “Doppelgänger” due to the high quality of the forgery of the different news sites, the operators of this campaign succeeded to create almost perfect replica of its targets: the design and aesthetic of the websites were seemingly identical to the original legacy outlets, and their domain was “spoofed” to lend credence.
For example, the fake Russian version of the Israeli news site Mako used the domain mako.news instead of mako.co.il. Two fake stories were published by the website, headlined “Solidarity with Ukraine is too expensive” and “Zelenskyy’s attacks on Iran only harm Israel.” Both also had a byline by two real reporters at Mako.
When entering the reports through mobile devices, however, a different author would appear: Amnon Abramovich, one of Israel’s most-known television news military analysts. There is even a forged view counter that claims each of the reports was read by over 50,000 people.
Despite the high quality of the forgery and its technical specification, the operators did make careless mistakes. For example, Abramovich’s photo showed President Zelenskyy instead.
Zelenskyy was prominently featured in the Russian campaign which mainly echoed the Russian talking point that any support for Ukraine was exacting a heavy toll on western states. The fake story “Solidarity with Ukraine is too expensive” was published in Hebrew on the websites Mako and Liberal (whose owner, Leonid Nevzlin, holds 25 percent of Haaretz’s shares), and in the Jewish Journal website in English.
The stories were pushed out through a complex array of URLs and Facebook ads. They were also shared on Twitter by fake accounts. A review of these accounts led reporters from Le Monde and Der Spiegel to two other fake websites set up as part of the campaign pretending to represent the French and German Foreign Ministries.
The stories were pushed out through a complex array of URLs and Facebook ads. They were also shared on Twitter by fake accounts. A review of these accounts led reporters from Le Monde and Der Spiegel to two other fake websites set up as part of the campaign pretending to represent the French and German Foreign Ministries.
In contrast to past disinformation campaigns, this one did not cease to operate after being outed by Meta in 2022. To keep running and avoid detection, a number of technically complex systems were put into place.
First, the articles were behind a complex array of URLs that redirected readers from one website to the next, thus hiding the original website and allowing operators to keep promoting the forged sites through Facebook ads.
Second, in some cases, a “geofencing” mechanism was used so only those from target countries could see the content, limiting the campaign’s potential exposure. Thus, some of the stories in German which were published on fake German outlets were only accessible via Germany, and those in Hebrew only from Israel.
According to French authorities, the operation did not include just forged new sites by copying real ones, but also what can be thought of as creating original fake news of their own. For example, the website RRN (Real Relevant News), which was also flagged by Meta, was called out by the French as being central to the operation. The website, reporters found, employed freelancers and even managed to score an interview with a French lawmaker, publishing its own reports and amplifying them through seemingly benign URLs, ads and avatars.
It is also worth mentioning that the campaign also seemed to have been used internally to target Russians. Some of the spoofed German reports, for example, were distributed on Russian Telegram channels minutes after they were posted online.
Since it invaded Ukraine in February 2022, a number of disinformation campaigns advancing Russian interests have been revealed, though not directly attributed to Russia. Exactly a year ago, Haaretz’s new cyber, technology and open-source investigation desk revealed two fake websites pretending to be the personal blogs of Haaretz journalists, among them editor-in-chief Aluf Benn, advancing similar narratives through fake information.
In recent years, so-called Foreign Information Manipulation and Interference or (FIMI), has increasingly become a national security issue. The current case is the first time France is naming Russia directly. In the past it has limited itself to only calling out such efforts by Russian proxies, for example the mercenary Wagner Group.
Earlier this week, another disinformation effort, also attributed to a foreign country, was exposed after it was echoed by Israel’s National Security Minister Itamar Ben-Gvir.
